No functional change, refactor the helper so that custom sport can be
passed into the hashing function.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Kubernetes doc says [0]:

  If you want to make sure that connections from a particular client are
  passed to the same Pod each time, you can select the session affinity
  based on the client's IP addresses by setting `.spec.sessionAffinity`
  to `ClientIP` for a Service (the default is `None`).

In Cilium we do support session affinity natively [1]. Now, we also support
Maglev consistent hashing. The latter ensures consistent backend selection
across nodes (as opposed to a random pick).

When session affinity is in play with Maglev, then while it consistently
picks backends respecting client IP on a per-node basis, it does not pick
the same backend across nodes. This is due to Maglev taking in the source
port as part of the hash for the Maglev LUT lookup, so if the source port
changes, then backend selection becomes inconsistent.

This has been reported by Sebastian Zengerle:

  I am testing Cilium L4 LB with Maglev Algorithm. To test Maglev I've
  deployed 3 nodes connected via BGP to the uplink router and used the
  LB IPAM feature. To test Maglev under routing changes (e.g. node
  rolling upgrade will lead to re-hashing on the uplink router) I am
  influencing the prefix metrics on the uplink router in a way that I can
  control to which worker the ECMP anycast traffic is sent. When I use
  static source ports session Affinity is working fine. All 3 workers
  select the same backend_id and sessionAffinity is working.

  But if I am using dynamic ports while I still shuffle the selected
  worker by the uplink router sessionAffinity is not working. I replaced
  dynamic ports with different local-ports in curl to have reproducible
  results. The sessionAffinity of the svc is set to ClientIP - so my
  expectation was at the beginning that all workers will select the
  same backend based on the clientId - but source port influences backend
  selection. More a problem is that the last step would break a connection
  when a routing change is happening. In the maps I can see that the
  backend_id decision on worker 1 was persisted (which was based on
  source port 12000) - while on the others it is based on 12001.
  Therefore workers are using different backend_id.

In order to keep the promise of Maglev, we need to remove the source port
from the hash to fix this situation.

Fixes: #26709
Reported-by: Sebastian Zengerle <sebastian.zengerle@googlemail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity [0]
Link: https://docs.cilium.io/en/latest/network/kubernetes/kubeproxy-free/#session-affinity [1]

Add a note into the session affinity section about the behavior under
Maglev.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>